Method and device for code obfuscation

Abstract

Compiled computer code comprising computer code instructions organised in a plurality of basic blocks is obfuscated by replacing a jump instruction in a first basic block with a function call with at least one parameter, wherein the function call when executed determines the address of the next function to execute in dependence on the parameter; inserting into the compiled computer code an instruction that allocates a value to the parameter, the value being such that the address determined by the function call corresponds to the address of the replace jump instruction. The allocation function is inserted into the computer code in a second basic block, different from the first basic block, preferably using information from a control flow graph. This can ensure that the obfuscated code cannot be disassembled without information from the CFG, while the CFG cannot be generated from the obfuscated code. Also provided is a device for code obfuscation.

Description

FIELD OF THE INVENTION[0001]The present invention relates generally to software, and in particular to obfuscated software.BACKGROUND OF THE INVENTION[0002]This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present invention that are described and / or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present invention. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.[0003]In “Obfuscation of Executable Code to Improve Resistance to Static Disassembly”, 10th ACM Conference of Computer and Communications Security (CCS), pages 290-299, October 2003, Linn and Debray suggest confusing disassemblers using two main techniques. The first technique is the insertion of junk code bytes inserted in places that are unreachable du...

AI Technical Summary

Benefits of technology

"The invention is about a method and device for obfuscating compiled computer code. The method involves replacing a jump instruction in a computer code with a function call with at least one parameter, where the function call determines the address of the next function to execute based on the parameter. An instruction that allocates a value to the parameter is inserted into the code in a different basic block from the jump instruction. The device includes a replacement unit, an insertion unit, and a finding unit that work together to achieve this. The technical effect of this invention is that it provides a way to protect the code from being easily understood and reverse-engineered, which can improve security and prevent unauthorized access to sensitive information."

Problems solved by technology

A difference with regard to Linn and Debray is that Jakubowski and Jacob's method uses functions that take dynamic input, which makes it very difficult, if not impossible, to disassemble the code statically.

Images